>> Okay, welcome back.
Now we'll talk about how
authentication works on most networks.
On most networks, you have single sign-on.
Basically, what that means is I'm able to
log in and provide my credentials one time,
and then I'm able to stay on the domain or in
the realm as long as my token hasn't expired.
But ultimately, I don't have to keep logging in
over and over for each resource I want to access.
For example, if I want to use the printer,
I don't have to log in again.
That is thanks to a protocol called Kerberos.
It's really both a protocol and a service.
This idea of a single sign-on on
our local domain has a lot of pros.
I was around in the peer-to-peer days
when you had a log on separately
to every system that had
a resource that you wanted to have access to.
That's a lot of usernames and passwords
>> to keep up with. We have that on the Internet
>> today for all the sites
that you go on to on the internet.
But at least in our work domain,
you don't have to log in for everything separately,
and you have single sign-on.
It's also easier for administrators,
because there's a single database
with usernames and passwords,
and is easier to create,
modify, and delete user accounts.
Now, the downside is that if I
have a centralized authentication server,
then you have a single point of failure.
We have to have an environment that accepts that
if I log onto the main controller one,
that it has to have all the applications
I need access to,
and it needs to follow certain standards
to make that possible.
The other thing is that if someone gets my password,
then they get access to everything.
But we've decided that the pros
outweigh the cons with the single sign-on.
Life is much better,
much easier, and more
secure in a single sign on environment.
Remember that it's Kerberos that allows
us to have single sign-on in our internal network.
Then we see SAML and
OpenID Connect as a means of extending
that single sign on out to
other organizations with whom we have federated trust.
Then you can extend single
sign-on into various tools that you'd like to use,
such as Microsoft 365, Salesforce,
and all types of other tools,
but let's focus on Kerberos for now.
This is a network authentication protocol.
It's going to be used in your internal network,
and it's a protocol and a service.
By the way, it uses port 88.
I always remember that because
there are 88 keys on a piano,
and keys and Kerberos both start with ke or ke.
Maybe that will help you remember it also.
Kerberos has been around for a long time.
It uses symmetric encryption
and you need to remember that.
This makes sure that users and
services are both authenticated.
You get some mutual authentication.
It's also very time sensitive,
and that's one of the ways we minimize
the risk of replay attacks.
Let's talk about how Kerberos works.
I like to think about the Carnival I
used to go to when I was a kid,
and how it relates to how Kerberos works.
I'm going to use that as my analogy to help explain it.
Now, once a year the carnival would come to town,
and they'd set up a big fence
around where the carnival ball was set up.
That was the carnival realm,
and I could not wait to get in it.
I remember that on Wednesday nights,
the admission was cheaper because they were
trying to get people to come on that night.
I would show up at the admission booth on
Wednesday night and I
paid to get into the carnival realm.
That would only give me the ability to get in,
it didn't not cover the price of
any rides or activities I wanted to do.
For that, you had to buy tickets.
All you got for the price of admission was
a wrist strap that they put on
you to show that you paid to get in.
If you had that, you could go to
the ticket booth to buy tickets
for all the other things you wanted to do.
If you didn't have a wrist strap,
they wouldn't sell you tickets to
the rides and other activities.
It turns out that the wrist strap is pretty important,
it proves that you came in the proper way.
Before I was old enough to go to the carnival alone,
I always went with my mom.
Now, my mom is a lovely lady,
but she is tight with money.
As a matter of fact, I had this vision of her going
into her room and counting
out her money like Scrooge McDuck,
because she is tight with a coin.
Back at the carnival,
if I wanted to go on a ride,
my mom wouldn't just give me 20 dollars so I could buy
all the tickets I wanted and
ride all the wild rides that I wanted.
No, she would give me
the minimum amount that I would
have to ride one thing at a time.
Each time I wanted to ride something different,
I'd have to go and ask her for more money.
Then I'd have to go back to
the ticket booth to get tickets for that ride.
I only had to go through the admission gate one time,
but I had to go back to the ticket booth many times.
The point I wanted to make here is that you
come into the carnival through the admission booth.
When you come in properly and pay
your admission, you get a wrist strap.
That wrist strap proves that you come in
correctly and allows you to buy tickets.
For each ride you want to ride,
you have to buy tickets.
That means you may have to go back to the ticket booth.
Every time you have to show
your wrist strap to buy more tickets.
That's exactly how Kerberos works.
We'll talk more about that next.